CVE-2021-41357

CVE-2021-41357 is an elevation-of-privilege vulnerability in the Microsoft Win32k kernel component, rated 7.8 (high) with a local attack vector, low privileges required, and no user interaction needed. It is triggered by an attacker who already has a foothold as a low-privileged local user (for example after phishing or by chaining with another exploit) executing code that reaches the vulnerable Win32k code paths. Successful exploitation yields elevated kernel-level privileges with high impact on confidentiality, integrity, and availability, effectively giving the attacker full administrative control of the host. Affected systems include Windows 10 versions 2004, 20H2, and 21H1, Windows 11 21H2, and Windows Server versions 2004, 20H2, and 2022. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2022-04-25, confirming exploitation in the wild; no public proof-of-concept is known and ransomware usage is unconfirmed, while EPSS estimates a 2.1% chance of exploitation in the next 30 days.

What to do: Apply the October 2021 Microsoft Patch Tuesday security updates (or later cumulative updates) per Microsoft's instructions for every affected Windows 10, Windows 11, and Windows Server build, as required by the CISA KEV listing. Because this is a local privilege escalation, prioritize patching hosts where untrusted users or processes get local code execution, such as VDI, remote desktop servers, and shared workstations, and verify each host's installed cumulative update level. As a Win32k EoP flaw there is no widely documented workaround in the data, so patching is the primary remediation.